# MinterUpgradeable: double-subtracting smNFT burns causes rebase underpayment

MinterUpgradeable.calculate_rebase double-subtracts smNFT burn balance from circulatingBlack, understating rebase and overpaying gauge emissions each epoch.

- Payout: Contest reward
- Severity: medium
- Program: Blackhole
- Credited: lonelybones
- Disclosed: 2025-07-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-05-blackhole#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** MinterUpgradeable.calculate_rebase() in Blackhole emissions contracts
**Root cause:** smNFT creation burns BLACK, reducing totalSupply; calculate_rebase reads that already-reduced supply as _blackTotal then subtracts _smNFTBalance again, double-counting the burn.
**Steps:**
1. Deploy Black, VotingEscrow, MinterUpgradeable with mocks for GaugeManager/RewardsDistributor/BlackGovernor.
2. user1 create_lock(10000e18, 52 weeks, false) and create_lock(50000e18, 52 weeks, true) to mint an smNFT and burn BLACK.
3. Advance time past active_period + WEEK and call minter.update_period().
4. Compare minter.calculate_rebase(weekly) against corrected `_blackTotal - _veTotal` formula; contract value is lower.
5. Observe RewardsDistributor receives the understated rebase and GaugeManager allowance is inflated by the difference.
**How found:** Code review of calculate_rebase traced that smNFT creation burns BLACK (VotingEscrow.sol#L796/#L933) reducing totalSupply, then noticed _smNFTBalance subtracted again in circulatingBlack.
**Exploitation:** No attacker action; the flaw is a persistent accounting error in the protocol's own emission distribution each epoch, diverting value from LPs/stakers to gauge-directed veBLACK voters.
**Insight:** When auditing rebase/emission formulas, verify whether each subtracted term is already reflected in totalSupply via a burn; smNFT-style bonus tokens that burn principal are a classic double-subtraction trap.